Convert burnerUser, NikeNotifications, MMWUsers, wifiHotspot to LAVA @artifact_processor by abrignoni · Pull Request #757 · abrignoni/ALEAPP · GitHub
Skip to content

Convert burnerUser, NikeNotifications, MMWUsers, wifiHotspot to LAVA @artifact_processor #757

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
abrignoni merged 1 commit into from
Jun 20, 2026
Merged

Convert burnerUser, NikeNotifications, MMWUsers, wifiHotspot to LAVA @artifact_processor #757

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
84 changes: 33 additions & 51 deletions scripts/artifacts/MMWUsers.py
View file
Open in desktop
79 changes: 20 additions & 59 deletions scripts/artifacts/NikeNotifications.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# pylint: disable=W0613,W1309
# pylint: disable=W0613
__artifacts_v2__ = {
"get_nike_notifications": {
"name": "NikeNotifications",
Expand All @@ -10,77 +10,38 @@
"category": "Nike-Run",
"notes": "",
"paths": ('*/com.nike.plusgps/databases/ns_inbox.db*',),
"output_types": None,
"output_types": "standard",
"artifact_icon": "activity",
"function": "get_nike_notifications",
}
}

# Get Information relative to the notifications stored in the database of the Nike Run Club Mobile application
# Author: Fabian Nunes {fabiannunes12@gmail.com}
# Date: 2023-03-18
# Version: 1.0
# Requirements: Python 3.7 or higher
import datetime

from scripts.artifact_report import ArtifactHtmlReport
from scripts.ilapfuncs import logfunc, tsv, timeline, open_sqlite_db_readonly
from scripts.ilapfuncs import artifact_processor, logfunc, open_sqlite_db_readonly


@artifact_processor
def get_nike_notifications(files_found, report_folder, seeker, wrap_text):
logfunc("Processing data for Nike Notifications")
files_found = [x for x in files_found if not x.endswith('-journal')]
file_found = str(files_found[0])
db = open_sqlite_db_readonly(file_found)

files_found = [x for x in files_found if not str(x).endswith('-journal')]
source_path = str(files_found[0])
db = open_sqlite_db_readonly(source_path)
cursor = db.cursor()
cursor.execute('''
Select
_id,
sender_user_id,
sender_app_id,
datetime("notification_timestamp"/1000,'unixepoch'),
notification_type,
message,
read,
deleted
Select _id, sender_user_id, sender_app_id, notification_timestamp,
notification_type, message, read, deleted
from inbox
''')

all_rows = cursor.fetchall()
usageentries = len(all_rows)
if usageentries > 0:
logfunc(f"Found {usageentries} notifications")
report = ArtifactHtmlReport('Nike - Notifications')
report.start_artifact_report(report_folder, 'Nike - Notifications')
report.add_script()
data_headers = ('ID', 'Sender User ID', 'Sender App ID', 'Notification Timestamp', 'Notification Type', 'Message', 'Read', 'Deleted')
data_list = []
for row in all_rows:
read = row[6]
if read == 0:
read = 'No'
else:
read = 'Yes'
deleted = row[7]
if deleted == 0:
deleted = 'No'
else:
deleted = 'Yes'

data_list.append((row[0], row[1], row[2], row[3], row[4], row[5], read, deleted))

table_id = "nike_notifications"
report.filter_by_date(table_id, 1)
report.write_artifact_data_table(data_headers, data_list, file_found, table_id=table_id)
report.end_artifact_report()

tsvname = f'Notifications'
tsv(report_folder, data_headers, data_list, tsvname)

tlactivity = f'Notifications'
timeline(report_folder, tlactivity, data_list, data_headers)
db.close()
logfunc(f"Found {len(all_rows)} notifications")

else:
logfunc('No Nike Notifications data available')
data_list = []
for row in all_rows:
timestamp = datetime.datetime.fromtimestamp(int(row[3]) / 1000, datetime.timezone.utc) if row[3] else ''
read = 'No' if row[6] == 0 else 'Yes'
deleted = 'No' if row[7] == 0 else 'Yes'
data_list.append((row[0], row[1], row[2], timestamp, row[4], row[5], read, deleted))

db.close()
data_headers = ('ID', 'Sender User ID', 'Sender App ID', ('Notification Timestamp', 'datetime'), 'Notification Type', 'Message', 'Read', 'Deleted')
return data_headers, data_list, source_path
71 changes: 26 additions & 45 deletions scripts/artifacts/burnerUser.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# pylint: disable=W0611,W0613,W0631
# pylint: disable=W0613
__artifacts_v2__ = {
"get_burnerUser": {
"name": "Burner: Second Phone Number",
Expand All @@ -10,63 +10,44 @@
"requirements": "none",
"category": "Burner",
"notes": "",
"paths": ('*/data/com.adhoclabs.burner/databases/burnerDatabase.db*'),
"output_types": None,
"paths": ('*/data/com.adhoclabs.burner/databases/burnerDatabase.db*',),
"output_types": "standard",
"artifact_icon": "user",
"function": "get_burnerUser"
}
}

import sqlite3
import datetime

from scripts.artifact_report import ArtifactHtmlReport
from scripts.ilapfuncs import logfunc, timeline, tsv, is_platform_windows, open_sqlite_db_readonly, convert_ts_human_to_utc, convert_utc_human_to_timezone
from scripts.ilapfuncs import artifact_processor, open_sqlite_db_readonly


@artifact_processor
def get_burnerUser(files_found, report_folder, seeker, wrap_text):

data_list = []

source_path = ''
for file_found in files_found:
file_found = str(file_found)

if file_found.endswith('burnerDatabase.db'):
db = open_sqlite_db_readonly(file_found)
#SQL QUERY TIME!
cursor = db.cursor()
cursor.execute('''
if not file_found.endswith('burnerDatabase.db'):
continue

source_path = file_found
db = open_sqlite_db_readonly(file_found)
cursor = db.cursor()
cursor.execute('''
SELECT
datetime(json_extract(BurnerEntity.value, '$.dateCreated')/1000, 'unixepoch') as 'Date Created',
json_extract(BurnerEntity.value, '$.dateCreated') as 'Date Created',
id as 'User ID',
json_extract(BurnerEntity.value, '$.phoneNumberId') as 'Phone Number',
json_extract(BurnerEntity.value, '$.autoReplyText') as 'Auto Reply Message'
FROM BurnerEntity
''')
''')
all_rows = cursor.fetchall()
db.close()

all_rows = cursor.fetchall()
usageentries = len(all_rows)
if usageentries > 0:
for row in all_rows:

data_list.append((row[0],row[1],row[2],row[3]))
db.close()

else:
continue

if data_list:
description = 'Burner: Second Phone Number'
report = ArtifactHtmlReport('Burner User Information')
report.start_artifact_report(report_folder, 'Burner User', description)
report.add_script()
data_headers = ('Timestamp','User ID','Phone Number','Auto Reply Message')
report.write_artifact_data_table(data_headers, data_list, file_found,html_escape=False)
report.end_artifact_report()

tsvname = 'Burner User'
tsv(report_folder, data_headers, data_list, tsvname)

tlactivity = 'Burner User'
timeline(report_folder, tlactivity, data_list, data_headers)

else:
logfunc('No Burner data available')
for row in all_rows:
created = datetime.datetime.fromtimestamp(int(row[0]) / 1000, datetime.timezone.utc) if row[0] else ''
data_list.append((created, row[1], row[2], row[3]))

data_headers = (('Timestamp', 'datetime'), 'User ID', ('Phone Number', 'phonenumber'), 'Auto Reply Message')
return data_headers, data_list, source_path
38 changes: 15 additions & 23 deletions scripts/artifacts/wifiHotspot.py
View file
Open in desktop
Loading